Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,894
7,228
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects network activity and DNS lookups associated with the domain 'loopedin.io', which has been identified as a second-hop open-redirect service used in forged healthcare-themed phishing campaigns. The rule specifically monitors connections from common web browsers to facilitate the identification of redirected user traffic.
This rule monitors network traffic for outbound connections to a specific remote IP address (38.60.253.35) on port 8084. This pattern is indicative of communication with a known command-and-control server or malicious infrastructure.
Correlates the creation and immediate deletion of the 'trin.tar.gz' archive, which is handled by the Python temporary-directory context manager, indicating potential malicious activity associated with TeamPCP.
Detects instances where a process command line includes both 'base64' and '.env', indicating potential encoding of sensitive .env files. Attackers often encode these files before exfiltration to bypass basic Data Loss Prevention (DLP) string matching and obscure the data.
Detects the execution of known enumeration shell scripts (opsec_enum.sh, oops_enum.sh) using common Unix command interpreters (bash, sh, dash). These scripts are commonly used by threat actors during the post-exploitation reconnaissance phase to gather system or environment information.
Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Identifies the payload establishing persistence on macOS by utilizing launchctl to load the fake ChromeUpdater plist job.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) initiating network connections to api.adblock-for-youtube.com to fetch scriptlets. This behavior is associated with bypassing URL validation to enable script injection on non-YouTube domains.
Detects behavior associated with the 'Adblock for YouTube' browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) involving the injection of arbitrary JavaScript into the MAIN world of web pages. This occurs via remotely fetched script rules and the use of 'trusted-create-element' or similar methods to bypass browser sandboxing for script tag insertion and DOM access.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Detects DNS requests originating from endpoints targeting the 'adblock-for-youtube.com' domain. This activity may be associated with browser extensions that exhibit unexpected or potentially unwanted network behavior.
Detects credential and session data exfiltration by browsers communicating with Bluekit PhaaS-associated domains or Telegram API webhooks. The rule filters network traffic originating from common web browsers to known malicious domains associated with Bluekit infrastructure or to the public Telegram API for automated exfiltration.
Detects the execution of Node.js processes associated with hijacked npm packages 'html-to-gutenberg' and 'fetch-page-assets'. The rule monitors for 'node' or 'node-gyp' processes spawned in conjunction with command-line arguments or file paths referencing these specific malicious packages, which are known to use binding.gyp command expansion for unauthorized code execution.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
Detects the presence of known malicious browser extensions by their extension ID or extensions that declare overly permissive host access ('<all_urls>') in combination with suspicious naming conventions associated with common ad-blocking malware.
This rule detects network activity associated with known malicious browser extensions identified as 'AdBlock' variants. It monitors for connections to the domain 'api.adblock-for-youtube.com' or requests to '/api/v2/rules' made by specific extension IDs that are known to perform unauthorized or suspicious activities.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance. This search leverages the Endpoint and Web CIM data models.
Page 130 of 173